GHSA-rjf2-j2r6-q8gr

Prototype Pollution in vm2

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23449

Packages

Ecosystem	Package	Affected	Fixed in
npm	vm2	< 3.9.4	3.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23449 advisory
https://github.com/patriksimek/vm2/issues/363 web
https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886 web
https://github.com/patriksimek/vm2 package
https://github.com/patriksimek/vm2/releases/tag/3.9.4 web
https://security.netapp.com/advisory/ntap-20211029-0010 web
https://snyk.io/vuln/SNYK-JS-VM2-1585918 web